Many websites/services require passwords have at least 8 characters with one number, one upper case letter and one special character. I don’t know if there are any specs for passwords here.
Mine’s pretty short so I should change it. Can do that here — https://freerepublic.com/perl/edit-account
One issue might be that the things you mention are fairly recent and you can probably download a library or find a drop-in but maybe not in Perl.
Two factor auth with text sent to phone requires SMS sending ability which would likely have to be paid SAAS.
Also, some people don’t have a cell phone.
I just logged into indeed and they send a 6 digit login code via email so that might be a better option. They send it as text in the email but also show my device, IP address and location so that probably has to match what the login page sniffed out when I plugged in my email address. There’s usually a time limit on using the code too.
Then there’s the check the box for Are you human? Might be a strictly google service thing.
When I go through my VPN, facebook makes me type in the code from an ugly obscured image on a secondary login page so that’s another method but I don’t know what it entails.
One 2Fa login method for my bank will call my home phone and then I hit 1 and get logged in but I’m sure that would be SAAS.
Many forgot password systems give you a magic reset password link, usually with a time limit for use, that takes you to a page to enter a new password and then makes you log in after resetting it.
I can live with 2-factor to email addresses. Less secure than phones, but better than nothing.